Computerized system and method for policy-based content filtering

ABSTRACT

Firewalls and other filtering gateways have become common security devices for improving computer network security. As more features and functionality are added to these devices they become quite complex to configure. By associating configuration schemes with firewall policies, configuration can be simplified without compromising flexibility. Administrators have more options to filter different traffic streams based on their type and sources. They also have increased flexibility to be able to filter traffic on a per user basis, through authentication mechanisms tied to various filtering options.

FIELD OF THE INVENTION

The present invention generally relates to network security and morespecifically to network content processing using a firewall.

DESCRIPTION OF THE RELATED ART

Security threats have evolved dramatically over the past 10 years,moving from network-level, connection-oriented attacks toapplication-level, agent-based attacks. Conventional networking devices(firewalls) can deal with network-level packet processing; for example,conventional firewalls can stop packets that do not come from a validsource, and VPN gateways can encrypt packets on the fly, making it safefor them to traverse the Internet.

But today's critical network threats, like viruses and worms, areembedded in the application-level contents of packet streams. Enormousprocessing power is needed to detect and stop these application-layerthreats by extracting the content from multiple packets, reconstructingthe original content, and scanning it for the telltale signs of attacksor for inappropriate content.

A firewall is typically implemented as a hardware/software appliancehaving a number of physical networking interfaces for the incoming andoutgoing network traffic. Firewalls can be software-implemented andinstalled on a stand-alone computer, or they can be full-blown hardwareappliances placed in a network to filter traffic going between multiplecomputers and/or the Internet. Network traffic enters one of theseinterfaces and, after filtering and other appropriate processing, isrouted to a remote host typically attached to a different physicalinterface.

In a firewall, processing of network traffic is performed in accordancewith a set of specific rules which collectively form a firewall policy.The firewall policy dictates how the firewall should handle networktraffic associated with specific applications such as web browsers,email or telnet. Exemplary rules include filtering of banned words,blocking specific URLs, blocking transmission of specific file types,antivirus scans, blocking of spam, etc. The firewall policy is usuallycreated by the network administrator and is based on the informationsecurity policy of the respective organization.

Conventional firewalls were capable of blocking traffic at the packetlevel but were not intelligent enough to examine the content of thosepackets and to protect against application-layer threats. Modernfirewalls have the ability to examine the content of various networktraffic streams and appropriately react to threats transfered within thecontent of the traffic stream. With the growth of these abilities of thefirewalls, there has also been a growth in the number of options andsettings that an administrator would need to configure to ensure asecure network.

Many existing firewall systems use global configuration settings, suchas global lists of URLs to block, lists of spam addresses, options toscan for viruses, spam, and others similar parameters. These settingsare applied globally to all policies within the firewall.

This approach, however, does not provide much flexibility to theadministrator. For example it may be desirable to block general staffmembers of an organization from accessing certain websites that don'tnecessarily contain objectionable material but may be a workdistraction. On the other hand, staff managers may not need to berestricted from accessing the same websites. Using global configurationoptions to enable the above firewall configuration presents a difficulttask. In other words, the existing firewall systems, which are oftenconfigured using global settings, tend to apply the same firewallconfiguration scheme to all the network content passing through thefirewall.

Therefore, what is needed is a firewall system providing a flexible andeffective control over configuration parameters applied to filteringand/or processing of various network content. Such a system wouldachieve an optimal content processing performance without compromisingthe security of the protected network.

SUMMARY OF THE INVENTION

The present invention is directed to methods and systems thatsubstantially obviate one or more of the above and other problemsassociated with conventional techniques for configuring firewalls tofilter and/or otherwise process network content.

One aspect of the inventive concept is a method, computer programmingproduct and a computer system for processing network content. Inaccordance with the inventive method, an incoming network connectioncharacterized by a source network address, a destination network addressand a network service protocol is received. The inventive system thendetermines the network service protocol of the incoming networkconnection and identifies a matching policy based on the source networkaddress, the destination network address and the network serviceprotocol. The inventive system further retrieves one or moreconfiguration scheme associated with the matching policy and processesnetwork traffic associated with the incoming network connection based onthe retrieved one or more configuration schemes.

Another aspect of the inventive concept is a computer-readable mediumembodying a configuration scheme for configuring a computerized firewallsystem to process network traffic associated with an incoming networkconnection. The inventive configuration scheme includes information onone or more communication protocols as well as one or more settings foreach communication protocol. Upon receiving an incoming networkconnection by the inventive firewall system, the one or more settings ofthe configuration scheme are applied to configure the computerizedfirewall system based on a source network address, a destination networkaddress and a network service protocol associated with the incomingnetwork connection.

Yet another aspect of the inventive concept is a computer-readablemedium embodying a firewall policy for use in connection with acomputerized firewall system. The inventive firewall policy includes atleast one source network address, at least one destination networkaddress, at least one service network protocol, at least oneconfiguration scheme identifier associating the firewall policy with acorresponding configuration scheme as well as information identifying anaction to be taken when the policy is invoked. Upon receiving theincoming network connection by the inventive firewall system, thefirewall policy is invoked based on the at least one source networkaddress, the at least one destination network address and the at leastone network service protocol.

Yet another aspect of the inventive concept is a computer-readablemedium embodying a configuration database for use in connection with acomputerized firewall system. The inventive configuration databasestores a configuration scheme and a firewall policy linked to theconfiguration scheme. Upon the receipt of an incoming network connectionby the inventive firewall system, the inventive firewall system invokesthe stored firewall policy and applies the stored configuration scheme.

Yet another aspect of the inventive concept is a firewall system forprocessing network traffic. The inventive firewall system includes anetworking interface for receiving a network connection, a networkingsubsystem, a proxy subsystem supporting one or more network protocols;and a configuration database for storing a firewall policy and afirewall configuration scheme. The networking subsystem re-directs thenetwork connection to the proxy subsystem based on the firewall policy,which processes the network traffic associated with the networkconnection based on the firewall configuration scheme.

Additional aspects related to the invention will be set forth in part inthe description which follows, and in part will be obvious from thedescription, or may be learned by practice of the invention. Aspects ofthe invention may be realized and attained by means of the elements andcombinations of various elements and aspects particularly pointed out inthe following detailed description and the appended claims.

It is to be understood that both the foregoing and the followingdescriptions are exemplary and explanatory only and are not intended tolimit the claimed invention or application thereof in any mannerwhatsoever.

BRIEF DESCRIPTION OF THE DRAWINGS

The accompanying drawings, which are incorporated in and constitute apart of this specification exemplify the embodiments of the presentinvention and, together with the description, serve to explain andillustrate principles of the inventive technique. Specifically:

FIG. 1 depicts a conceptual block-diagram of a firewall system inaccordance with an embodiment of the inventive concept;

FIG. 2 illustrates operating sequence of an embodiment of the inventivefirewall system associated with establishing a basic networkcommunication session;

FIGS. 3 and 4 display exemplary embodiments of a graphical userinterface which may be used in defining one or more configurationschemes;

FIGS. 5 and 6 illustrate exemplary embodiments of graphical userinterfaces for displaying and adjusting parameters of firewall policies;

FIGS. 7 and 8 illustrate alternative embodiments of the user interfaceof the inventive firewall system;

FIG. 9 illustrates an exemplary operating sequence of an embodiment ofthe inventive firewall system;

FIG. 10 illustrates an alternative exemplary operating sequence of anembodiment of the inventive firewall system; and

FIG. 11 illustrates a computer platform upon which an embodiment of theinventive methodology may be implemented.

DETAILED DESCRIPTION

In the following detailed description, reference will be made to theaccompanying drawing(s), in which identical functional elements aredesignated with like numerals. The aforementioned accompanying drawingsshow by way of illustration, and not by way of limitation, specificembodiments and implementations consistent with principles of thepresent invention. These implementations are described in sufficientdetail to enable those skilled in the art to practice the invention andit is to be understood that other implementations may be utilized andthat structural changes and/or substitutions of various elements may bemade without departing from the scope and spirit of present invention.The following detailed description is, therefore, not to be construed ina limited sense. Additionally, the various embodiments of the inventionas described may be implemented in the form of a software running on ageneral purpose computer, in the form of a specialized hardware, orcombination of software and hardware.

The inventor recognized that it would have been advantageous to providemethods and systems which would enable more granular control overfirewall settings. Such configuration flexibility was not permittedunder the conventional techniques.

Generally, firewall policies are designed to control the flow of networktraffic through the firewall. A typical firewall policy defines a set ofrules applied to handling of the entire passing network traffic or anyspecific portion thereof. The portion of the network traffic to which apredetermined firewall policy applies may be specified using, forexample, the network address of the source entity, the network addressof the destination entity as well as the networking protocol used in thetransmission. Different firewall policies may be assigned to differenttransmission protocols, which, in turn, implement different networkingservices.

When a specific network connection is initiated, the connection willcommonly have an associated source network address, destination networkaddress and service port identifier. This information is gathered by thefirewall and checked against existing firewall policies. If theconnection information matches a specific firewall policy, the firewallapplies the relevant policy to the connection.

Low-level, network layer firewalls generally may only permit or rejectthe network traffic, typically at the network packet level, and theymake their decisions based on the source and destination addresses andthe associated network ports in individual IP packets. In suchfirewalls, the set of rules associated with the firewall policy maygenerally specify which network traffic is permitted to proceed andwhich is rejected and the firewall policy may be defined in terms ofsource and destination IP addresses together with the associatedcommunication ports. This information is contained in individual IPpackets and is retrieved by the firewall upon packet inspection.

Higher-level, content-filtering application layer firewalls generallyare hosts running proxy servers, which permit no traffic directlybetween networks, and which perform elaborate logging and auditing oftraffic passing through them. Because the proxy applications aresoftware components running on the firewall, they are used to performlogging and access control. In such systems, the firewall policy mayprovide an additional option for handling of the network traffic, whichmay include re-directing specific packets to another routine or program,such as a proxy, which may perform a specified operation upon thepackets or gather the content of the packets for deeper examinationand/or logging. Because of the greater flexibility of the networktraffic processing in the proxy, the configuration of the proxy mayinvolve a substantial number of configuration parameters.

In accordance with an embodiment of the invention, in a firewall systemhaving the ability to redirect the communication stream to the proxyprogram, each firewall policy is provided with an associated collectionof settings. These settings may generally include, but are not limitedto, various types of filters. By having the ability to associate acollection of settings (hereinafter referred to as “configurationscheme”) with individual firewall polices, the administrator of theinventive firewall system has a greater control over how variouscommunication pathways are filtered.

In an exemplary embodiment of the inventive firewall system, aconfiguration scheme is associated with a specific firewall policy bymeans of a scheme identifier, a variable that is stored in a datastructure associated with the firewall policy, which is called a “policystructure.” The policy structure may be disposed within the kernel ofthe firewall computer system. When a new communication session matchinga particular firewall policy is initiated, this session inherits thescheme identifier value from the corresponding policy structure. Theproxy program, to which the communication connection is redirected, thenretrieves this identifier value from the communication connectionstructure and uses it to look up the scheme settings from theconfiguration database or, alternatively, from a local cache. Theconfiguration database in the inventive system may be as simple as atext file holding records of information or as complex as a fullyfeatured database system.

FIG. 1 illustrates a topology of a firewall-protected network 100 inaccordance with an exemplary embodiment of the inventive concept. Twonetwork entities 104 and 105 are connected to opposite sides of aphysical device (the firewall) 101, which monitors the network traffic108, 109 passing between them. The firewall 101 may drop or alter someof this traffic based on a predefined set of rules. Therefore, thecontent of the network traffic 108 may not be identical to the contentof the traffic 109. According to an embodiment of the inventivetechnique, the two network entities 104 and 105 are connected to thefirewall 101 by a direct link. In an alternative embodiment, theconnection is accomplished through a routed network (not shown).

As shown in FIG. 1, the firewall 101 is disposed within the networkcommunication channel between the two user systems 104 and 105 andmonitors network packet exchanges between them. As would be appreciatedby those of skill in the art, for some well-known protocols, such asTCP, the transmitted network packets can be inspected for known threatsor questionable content by one or more scanning engines. When a packetthat matches one of the known signatures is detected, the inventivefirewall system may generate a log message or set off an alarm, and thepacket may be dropped. In one embodiment of the inventive system, theentire connection between the two users would be dropped as well.

As would be also appreciated by those of skill in the art, in manycases, the rules or signatures used to detect questionable data cannotbe applied to individual packets.

Stream protocols, such as TCP, will break up data into smaller chunksduring transmission, but the detection heuristics must be applied to theentire data stream rather than the individual packets. Therefore, in theinventive system, the data would be first buffered by the firewall 101in order to extract the data stream, and then the filtering rules wouldbe applied to this stream. In many cases, the packets would beredirected by the networking subsystem 106 of the kernel of the firewall101 to a user space application (proxy) 107 that builds and interpretsthe data buffer.

The firewall system shown in FIG. 1 includes physical network interfaces102 and 103, and the aforesaid networking subsystem 106, which may beimplemented as a part of the kernel of the operating system of thefirewall appliance 101. The networking subsystem 106 routes the packetsbetween the physical interfaces 102 and 103 and transfers the databetween various logical subsystems on the firewall system 101. Severaltypes of stream-based data are intercepted by the networking subsystem106 and buffered by a proxying module 107 for future processing. Itshould be noted that while FIG. 1 shows only physical interfaces, inanother embodiment of the inventive firewall, one or both of theinterfaces 102 and 103 may be logical interfaces.

The networking subsystem 106 may be configured to intercept datatransmissions formatted in accordance with various networking protocolsincluding, without limitation, SMB/CIFS, IM protocols (e.g. AIM, MSNmessenger, Yahoo messenger, Skype), and P2P protocols (e.g. FastTrack,BEEP, gnutella, Avalanche, BitTorrent). Additionally, SMTP, POP3, IMAP,HTTP, FTP, telnet, etc. The intercepted data packets are routed to theproxy module 107 for re-assembly, inspection and other processing.

In one embodiment of the invention, the proxying module 107 isimplemented in the OS kernel. In an alternative embodiment, the proxy107 is implemented in the form of an application executing in theuserspace provided by the operating system of the firewall appliance101. The proxying module 107 assembles the formatted packets interceptedby the networking subsystem 106 in accordance with the specification ofthe respective communication protocol to arrive at the transmissioncontent. Depending on the specifics of the used communication protocol,an embodiment of the inventive system may provide for re-ordering of thedata packets prior to, or during the transmission re-assembly.

A configuration database 110 stores various firewall policies,configuration schemes and other parameters used by the firewall system101. The stored parameters are retrieved from the database 110 by theproxy 107. In one embodiment of the inventive system, the proxyingmodule 107 is configured to support one network protocol. In suchimplementation, multiple proxying subsystems may be provided if thesystem is designed to handle multiple protocols. Additionally oralternatively, multiple instances of proxy 107 may be executed tosupport the same network protocol or different network protocols.Moreover, the proxy 107 may be designed to support the entirecommunication language of the respective protocol or any portionthereof. Finally, the proxy 107 may use an external program to retrievevarious configuration settings from the database 110. Likewise, anexternal program may be used to apply various filters to the networktransmission content processed by the proxy 107.

FIG. 2 illustrates an operating sequence of the inventive firewallsystem associated with establishment of a basic network communicationsession. An incoming connection 201 is accepted by the networkingsubsystem 106 of the firewall kernel after a lookup of an applicablefirewall policy. In the shown sequence, the policy indicates that thesession should be redirected (at 202) to the user level proxy 107. Theproxy 107 performs any needed initialization and then queries the kernel(at 203) to retrieve the configuration scheme associated with thesession. Once the scheme identifier has been retrieved (at 204) theproxy queries (at 205) the configuration database (110) to retrieve thesettings for the configuration scheme matching the specified identifier.Once the settings are retrieved (at 206) the proxy 107 can continue withany filtering tasks or other tasks necessary to handle the networkingsession.

In an embodiment of the inventive concept, multiple configurationschemes may be specified by the network administrator using, forexample, a graphical user interface or a command line interface of thefirewall system 101. The settings specified by the administrator, aswell as other appropriate parameters, may be stored in the configurationdatabase 110 for subsequent retrieval. In an exemplary embodiment of theinventive technique, each created configuration scheme is assigned aunique identifier value, which may or may not be displayed to theadministrator. This identifier value is subsequently stored in one ormore data structures associated with the corresponding firewall policyand used to retrieve the appropriate configuration scheme.

The configuration database 110 may be implemented on the same computerplatform as the rest of the firewall 101. This database may beimplemented using any suitable database system, such as general-purposerelational database systems distributed by Oracle Corporation, IBMCorporation and Microsoft Corporation. In an alternative embodiment ofthe invention, a special-purpose embedded database may be utilized. Inyet alternative embodiment, the configuration database may beimplemented using file system facilities of the firewall 101. Finally,the database system 110 may be implemented on a separate computerhardware from the rest of the firewall 101.

FIGS. 3 and 4 display exemplary embodiments of a graphical userinterface which may be used by an administrator of the inventivefirewall system in defining one or more configuration schemes.Specifically, the interface 300 shown in FIG. 3 displays a list ofexisting configuration schemes 301-304. Each of the schemes 301-304 maybe assigned a unique name or alias for easy reference. Using theinterface 300, new schemes may be created and the existing schemes maybe modified or deleted.

The interface 400 shown in FIG. 4 displays a detailed view of a specificconfiguration scheme. The displayed exemplary scheme 400 is arrangedinto separate protocol sections (columns 401-406). Each such section mayinclude multiple configuration settings corresponding to the specificprotocol. The protocols shown in FIG. 4 include HTTP, FTP, SMTP, IMAP,POP3, SMB/CIFS. However, the invention is not limited only to the shownprotocols. Any other suitable protocols may be used. Normally, theinventive interface 400 only displays protocols supported by the proxyengine 107 of the firewall 101. However, as the proxy functionality isexpanded to support additional networking protocols, the graphical userinterface 400 may be configured, either manually or automatically, todisplay those additional protocols as well.

As may be appreciated by those of skill in the art, not allconfiguration settings are appropriate for all protocols. Therefore, inthe inventive interface 400, some settings are not available for someprotocols. For example, the e-mail spam block is not available fornon-email protocols. Various parameters of the specific configurationscheme displayed using the interface 400 may be input or adjusted by thenetwork administrator by means of toggle options (checkboxes), namedselections (drop down combo boxes), multi-selections, as well as numberand text based entries. The configuration scheme may include lists ofvarious items, such as lists of banned words or lists of HTTP URLs to beblocked. Such lists may be linked to appropriate graphical primitive(s)within the interface 400, such as items 408-410 shown in FIG. 4. Uponadministrator's selection of the appropriate graphical primitive, thecorresponding list may be displayed and the administrator may beprovided with an ability to add to or otherwise modify its content.

As it would be appreciated by those of skill in the art, the inventiveconcept is by no means limited only to the shown parameters andsettings. Various other settings and parameters may be displayed andappropriately configured by the interfaces 300 and 400. Moreover, theinterface 400 may be configured to automatically display new parametersand configuration options when it detects that the proxy module 107 ofthe firewall 101 has been enhanced to support new protocols as well asnew filtering and other content processing capabilities.

In addition to the capability to create and/or modify firewallconfiguration schemes, an embodiment of the inventive system isadditionally provided with a graphical user interface or, alternatively,a command line interface enabling an administrator to specify and managemultiple firewall policies. The policy settings may also be stored inthe configuration database 110. In an embodiment of the invention, atleast a portion of information descriptive of the policy settings isstored in the kernel of the firewall 101.

Exemplary embodiments of the policy-setting graphical user interfaces ofthe inventive firewall system 101 are illustrated in FIGS. 5 and 6.Specifically, exemplary interface 500 shown in FIG. 5 displays a list ofall firewall policies in effect. The shown interface 500 is organized ina tabular form with each of the rows 501, 502 and 503 corresponding tofirewall policies with policy identification numbers 1,2 and 5,respectively. Parameters in columns 504, 505 and 507 specify sourcenetwork address, destination network address and transmission protocolto which specific listed policy is made applicable. Column 506 specifieswhen the specific policy has effect. Column 508 contains settingsspecifying how the corresponding network traffic should be handled. Theconfiguration scheme for each effective policy is specified in column509. The network administrator is provided with an option to enable ordisable any specific policy and to modify or delete it, see columns 510and 511.

FIG. 6 illustrates graphical user interface 600 for displaying andadjusting various individual parameters of a specific firewall policy.The policy parameters included in the interface 600 generally correspondto the columns of interface 500. Using the interface 600, theadministrator may modify any appropriate policy settings.

As described in details above, any specific firewall policy may beprovided with an associated configuration scheme such that networkingprotocols supported by the policy are filtered or otherwise processed inaccordance with the settings of that configuration scheme. The relevantconfiguration scheme is identified and assigned to a session when thesession is created. At that point, the configuration scheme identifieris written into the policy structure in the kernel so that it can betransfered into new session structures as new sessions connect. If morethan one policy is defined, different policies may use either the sameconfiguration scheme, all different configuration schemes, or anycombination of the above. It is also permissible, in an embodiment ofthe invention, to apply no configuration scheme to a policy. In such acase, the policy becomes a conventional firewall policy with nofiltering capabilities. In another embodiment of the invention, multipleconfiguration schemes may be assigned to a single firewall policy.

In another embodiment of the invention, the policy based filters areimplemented using user authenticated groups. Specifically, certainfirewall policies may utilize some form of user authentication. Toenable utilization of such policies, one or more users on the networkmay be grouped together into one or more named groups of users, forexample Accounting Team. It should be noted that certain groups mayconsist of only one user. A specific firewall configuration scheme maybe assigned to a user group or an individual user. As it would beappreciated by those of skill in the art, the utilization of usergroup-based firewall policies and associated configuration schemesenables flexible assignment of different levels of use restrictions ofvarious network services to different groups of users.

FIGS. 7 and 8 illustrate an alternative embodiment of the user interfaceof the inventive firewall system. In the interface shown in FIG. 7,multiple configuration schemes are displayed on the same page togetherwith their parameters. Each of the rows 701 and 702 corresponds to aspecific configuration scheme, while each of the columns 703-707displays settings corresponding to one specific networking protocol. Onthe other hand, the interface 800 shown in FIG. 8 may be used to editvarious parameters associated with a specific configuration scheme. Inthe interface 800, shown in that figure, various protocols are groupedtogether in accordance with protocol type, including web protocol 801,mail protocols 802 and file transfer protocol 803. The configurationscheme parameters displayed in FIG. 8 generally correspond to parametersincluded in each of the rows 701 or 702 of FIG. 7.

FIG. 9 illustrates exemplary operating sequence 900 of an embodiment ofthe inventive firewall system 101. Upon the receipt of the incomingconnection, at step 902, the inventive firewall system 101 uses theconnection information to identify the applicable firewall policy, seestep 903. The relevant connection information may include, withoutlimitation, the connection source and destination addresses, as well asconnection service protocol determined in accordance to the connectionport number information. The necessary connection information may beextracted from the network packets intercepted by the networkingsubsystem 106 of the kernel.

At step 904, the system applies packet-layer firewall rules to determinewhether the connection should be allowed. Non-compliant connections arerejected at step 909. The allowed connections are checked against a listof service protocols supported by the proxy 107, see step 905. Contentformatted according to non-supported protocols is sent directly to thedestination at step 908. If the connection protocol is supported by theproxy 107, at step 906, the system checks whether a specificconfiguration scheme is assigned to the connection, and, if so, appliesthe scheme at step 907. At step 910, the system checks whether thetransmission content needs to be modified and modifies the content, ifappropriate, at step 911.

FIG. 10 illustrates an exemplary operating sequence 1000 of analternative embodiment of the inventive firewall system 101. Thesequence 1000 differs from the sequence 900 of FIG. 9 in applyingadditional authentication steps 1005 and 1006 to the networkingconnection. Specifically, upon determination, at step 904, that theconnection satisfies the packet-layer rules, the system authenticatesthe user and rejects the connection if the authentication fails, seesteps 1005 and 1006, respectively. In addition, in the sequence shown inFIG. 10, at step 1007, the inventive system checks for a configurationscheme assigned to the user/usergroup, which, in turn, corresponds tothe firewall policy that applies to the current connection. The foundscheme is then applied at step 907. The remaining steps of the sequence1000 are equivalent to the corresponding steps of the sequence 900 ofFIG. 9.

The hardware platform of the present invention will now be described.FIG. 11 is a block diagram that illustrates an embodiment of a computerplatform 1100 upon which an embodiment of the inventive methodology maybe implemented. The system 1100 includes a computer/server platform1101, peripheral devices 1102 and network resources 1103.

The computer platform 1101 may include a data bus 1104 or othercommunication mechanism for communicating information across and amongvarious parts of the computer platform 1101, and a processor 1105coupled with bus 1101 for processing information and performing othercomputational and control tasks. Computer platform 1101 also includes avolatile storage 1106, such as a random access memory (RAM) or otherdynamic storage device, coupled to bus 1104 for storing variousinformation as well as instructions to be executed by processor 1105.The volatile storage 1106 also may be used for storing temporaryvariables or other intermediate information during execution ofinstructions by processor 1105. Computer platform 1101 may furtherinclude a read only memory (ROM or EPROM) 1107 or other static storagedevice coupled to bus 1104 for storing static information andinstructions for processor 1105, such as basic input-output system(BIOS), as well as various system configuration parameters. A persistentstorage device 1108, such as a magnetic disk, optical disk, orsolid-state flash memory device is provided and coupled to bus 1101 forstoring information and instructions.

Computer platform 1101 may be coupled via bus 1104 to a display 1109,such as a cathode ray tube (CRT), plasma display, or a liquid crystaldisplay (LCD), for displaying information to a system administrator oruser of the computer platform 1101. An input device 1110, includingalphanumeric and other keys, is coupled to bus 1101 for communicatinginformation and command selections to processor 1105. Another type ofuser input device is cursor control device 11 11, such as a mouse, atrackball, or cursor direction keys for communicating directioninformation and command selections to processor 1104 and for controllingcursor movement on display 1109. This input device typically has twodegrees of freedom in two axes, a first axis (e.g., x) and a second axis(e.g., y), that allows the device to specify positions in a plane.

An external storage device 1112 may be connected to the computerplatform 1101 via bus 1104 to provide an extra or removable storagecapacity for the computer platform 1101. In an embodiment of thecomputer system 1100, the external removable storage device 1 1 12 maybe used to facilitate exchange of data with other computer systems.

The invention is related to the use of computer system 1100 forimplementing the techniques described herein. In an embodiment, theinventive content processing systems 300 and 400 may reside on a machinesuch as computer platform 1101. In an embodiment, database 313 may bedeployed on a machine such as computer platform 1101. According to oneembodiment of the invention, the techniques described herein areperformed by computer system 1100 in response to processor 1105executing one or more sequences of one or more instructions contained inthe volatile memory 1106. Such instructions may be read into volatilememory 1106 from another computer-readable medium, such as persistentstorage device 1108. Execution of the sequences of instructionscontained in the volatile memory 1106 causes processor 1105 to performthe process steps described herein. In alternative embodiments,hard-wired circuitry may be used in place of or in combination withsoftware instructions to implement the invention. Thus, embodiments ofthe invention are not limited to any specific combination of hardwarecircuitry and software.

The term “computer-readable medium” as used herein refers to any mediumthat participates in providing instructions to processor 1105 forexecution. The computer-readable medium is just one example of amachine-readable medium, which may carry instructions for implementingany of the methods and/or techniques described herein. Such a medium maytake many forms, including but not limited to, non-volatile media,volatile media, and transmission media. Non-volatile media includes, forexample, optical or magnetic disks, such as storage device 1108.Volatile media includes dynamic memory, such as volatile storage 1106.Transmission media includes coaxial cables, copper wire and fiberoptics, including the wires that comprise data bus 1104. Transmissionmedia can also take the form of acoustic or light waves, such as thosegenerated during radio-wave and infra-red data communications.

Common forms of computer-readable media include, for example, a floppydisk, a flexible disk, hard disk, magnetic tape, or any other magneticmedium, a CD-ROM, any other optical medium, punchcards, papertape, anyother physical medium with patterns of holes, a RAM, a PROM, an EPROM, aFLASH-EPROM, a flash drive, a memory card, any other memory chip orcartridge, a carrier wave as described hereinafter, or any other mediumfrom which a computer can read.

Various forms of computer readable media may be involved in carrying oneor more sequences of one or more instructions to processor 1105 forexecution. For example, the instructions may initially be carried on amagnetic disk from a remote computer.

Alternatively, a remote computer can load the instructions into itsdynamic memory and send the instructions over a telephone line using amodem. A modem local to computer system 1100 can receive the data on thetelephone line and use an infra-red transmitter to convert the data toan infra-red signal. An infra-red detector can receive the data carriedin the infra-red signal and appropriate circuitry can place the data onthe data bus 1104. The bus 1104 carries the data to the volatile storage1106, from which processor 11 05 retrieves and executes theinstructions. The instructions received by the volatile memory 1106 mayoptionally be stored on persistent storage device 1108 either before orafter execution by processor 1105. The instructions may also bedownloaded into the computer platform 1101 via Internet using a varietyof network data communication protocols well known in the art.

The computer platform 1101 also includes a communication interface, suchas network interface card 1113 coupled to the data bus 1104.Communication interface 1113 provides a two-way data communicationcoupling to a network link 1114 that is connected to a local network1115. For example, communication interface 1113 may be an integratedservices digital network (ISDN) card or a modem to provide a datacommunication connection to a corresponding type of telephone line. Asanother example, communication interface 1113 may be a local areanetwork interface card (LAN NIC) to provide a data communicationconnection to a compatible LAN. Wireless links, such as well-known802.11a, 802.11b, 802.11g and Bluetooth may also used for networkimplementation. In any such implementation, communication interface 1113sends and receives electrical, electromagnetic or optical signals thatcarry digital data streams representing various types of information.

Network link 1113 typically provides data communication through one ormore networks to other network resources. For example, network link 1114may provide a connection through local network 1115 to a host computer1116, or a network storage/server 1117. Additionally or alternatively,the network link 1113 may connect through gateway 1117 to the wide-areaor global network 1118, such as an Internet. Thus, the computer platform1101 can access network resources located anywhere on the Internet 1118,such as a remote network storage/server 1119. On the other hand, thecomputer platform 1101 may also be accessed by clients located anywhereon the local area network 1115 and/or the Internet 1118. The networkclients 1120 and 1121 may themselves be implemented based on thecomputer platform similar to the platform 1101.

Local network 1115 and the Internet 1118 both use electrical,electromagnetic or optical signals that carry digital data streams. Thesignals through the various networks and the signals on network link1114 and through communication interface 1113, which carry the digitaldata to and from computer platform 1101, are exemplary forms of carrierwaves transporting the information.

Computer platform 1101 can send messages and receive data, includingprogram code, through the variety of network(s) including Internet 1118and LAN 1115, network link 1114 and communication interface 1113. In theInternet example, when the system 1101 acts as a network server, itmight transmit a requested code or data for an application programrunning on client(s) 1120 and/or 1121 through Internet 1118, gateway1117, local area network 1115 and communication interface 1113.Similarly, it may receive code from other network resources.

The received code may be executed by processor 1105 as it is received,and/or stored in persistent or volatile storage devices 1108 and 1106,respectively, or other non-volatile storage for later execution. In thismanner, computer system 1101 may obtain application code in the form ofa carrier wave.

It should be noted that the present invention is not limited to anyspecific firewall system. The inventive policy-based content processingsystem may be used in any of the three firewall operating modes andspecifically NAT, routed and transparent.

Finally, it should be understood that processes and techniques describedherein are not inherently related to any particular apparatus and may beimplemented by any suitable combination of components. Further, varioustypes of general purpose devices may be used in accordance with theteachings described herein. It may also prove advantageous to constructspecialized apparatus to perform the method steps described herein. Thepresent invention has been described in relation to particular examples,which are intended in all respects to be illustrative rather thanrestrictive. Those skilled in the art will appreciate that manydifferent combinations of hardware, software, and firmware will besuitable for practicing the present invention. For example, thedescribed software may be implemented in a wide variety of programmingor scripting languages, such as Assembler, C/C++, perl, shell, PHP,Java, etc.

Moreover, other implementations of the invention will be apparent tothose skilled in the art from consideration of the specification andpractice of the invention disclosed herein. Various aspects and/orcomponents of the described embodiments may be used singly or in anycombination in the computerized network content processing system. It isintended that the specification and examples be considered as exemplaryonly, with a true scope and spirit of the invention being indicated bythe following claims.

1. A computer-implemented method for processing network content, themethod comprising: a. receiving an incoming network connection, theincoming connection being characterized by a source network address, adestination network address and a network service protocol; b.determining the network service protocol of the incoming networkconnection; c. identifying a matching policy based on the source networkaddress, the destination network address and the network serviceprotocol; d. retrieving one or more configuration scheme associated withthe matching policy; and e. processing network content associated withthe incoming network connection based on the retrieved one or moreconfiguration schemes.
 2. The method of claim 1, wherein the networkservice protocol comprises at least one of a group consisting of HTTP,FTP, SMTP, POP3, IMAP, and SMB/CIFS.
 3. The method of claim 1, whereinduring the identifying, the matching policy is selected from a pluralityof predefined policies.
 4. The method of claim 3, wherein if theplurality of predefined policies does not contain the matching policy, adefault policy is identified as the matching policy.
 5. The method ofclaim 1, wherein during the retrieving, the one or more configurationscheme is selected from a plurality of predefined configuration schemes.6. The method of claim 1, further comprising authenticating a userassociated with the incoming connection and rejecting the incomingconnection if the authentication is unsuccessful.
 7. The method of claim6, wherein the authenticated user is associated with one or more usergroups.
 8. The method of claim 7, wherein the retrieved configurationscheme is assigned to the one or more user groups.
 9. The method ofclaim 6, wherein the retrieved configuration scheme is determined by theidentity of the authenticated user.
 10. A computer-readable mediumembodying a configuration scheme for configuring a computerized firewallsystem to process network content associated with an incoming networkconnection, the configuration scheme comprising: information on one ormore communication protocols; and one or more settings for eachcommunication protocol; wherein upon receiving the incoming networkconnection by the computerized firewall system, the one or more settingsof the configuration scheme are applied to configure the computerizedfirewall system based on a source network address, a destination networkaddress and a network service protocol associated with the incomingnetwork connection.
 11. The computer-readable medium of claim 10,wherein the one or more communication protocol comprises at least one ofa group consisting of HTTP, FTP, SMTP, POP3, IMAP, and SMB/CIFS.
 12. Thecomputer-readable medium of claim 10, wherein the one or more settingscomprise at least one of a group consisting of toggle switches, lists,text entries, selection boxes, radio buttons, and multioptionselections.
 13. The computer-readable medium of claim 10, wherein theone or more settings are configured using a Graphical User Interface(GUI).
 14. The computer-readable medium of claim 10, wherein the one ormore settings are configured using a Command Line Interface (CLI). 15.The computer-readable medium of claim 10, wherein the one or moresettings are combined into one or more groups.
 16. The computer-readablemedium of claim 10, comprising additional configuration schemes.
 17. Thecomputer-readable medium of claim 10, wherein the configuration schemeis modifiable.
 18. A computer-readable medium embodying a firewallpolicy for use in connection with a computerized firewall system, thefirewall policy comprising: at least one source network address; atleast one destination network address; at least one service networkprotocol; at least one configuration scheme identifier associating thefirewall policy with a corresponding configuration scheme; andinformation identifying an action to be taken when the policy isinvoked; wherein upon receiving the incoming network connection by thecomputerized firewall system, the firewall policy is invoked based onthe at least one source network address, the at least one destinationnetwork address and the at least one network service protocol.
 19. Thecomputer-readable medium of claim 18, wherein the firewall policyfurther comprises information on at least one user group forauthentication.
 20. The computer-readable medium of claim 18, comprisingadditional firewall policies.
 21. The computer-readable medium of claim20, wherein the at least one configuration scheme identifier is assignedto one or more policies.
 22. The computer-readable medium of claim 20,wherein each firewall policy has a different configuration schemeidentifier.
 23. The computer-readable medium of claim 18, wherein thefirewall policy is modifiable.
 24. The computer-readable medium of claim18, wherein the at least one configuration scheme identifier comprisesnumeric information.
 25. The computer-readable medium of claim 18,wherein the at least one configuration scheme identifier comprisescharacter information.
 26. The computer-readable medium of claim 18,wherein the at least one configuration scheme identifier comprises oneor more binary bits.
 27. A computer-readable medium embodying aconfiguration database for use in connection with a computerizedfirewall system, the configuration database comprising: at least oneconfiguration scheme; and at least one firewall policy; wherein the atleast one firewall policy is linked to the at least one configurationscheme; and wherein upon receiving an incoming network connection by thecomputerized firewall system, the computerized firewall system invokesthe at least one firewall policy and applies the at least oneconfiguration scheme.
 28. The computer-readable medium of claim 27,wherein the configuration database further comprises policy settings forthe at least one firewall policy.
 29. The system as recited in claim 28,wherein the policy settings are capable of being configured using atleast one of a group consisting of a Graphical User Interface (GUI) andCommand Line Interface (CLI).
 30. The computer-readable medium of claim28, wherein the policy settings comprise at least one source networkaddress, at least one destination network address and at least onenetwork service protocol.
 31. The computer-readable medium of claim 28,wherein the policy settings are accessible to a software executingwithin the computerized firewall system.
 32. The computer-readablemedium of claim 27, wherein the configuration database further comprisesconfiguration scheme settings for the at least one firewall policy. 33.The computer-readable medium of claim 32, wherein the configurationscheme settings are capable of being configured using at least one of agroup consisting of a Graphical User Interface (GUI) and Command LineInterface (CLI).
 34. The computer-readable medium of claim 32, whereinthe configuration scheme settings are accessible to a software executingwithin the computerized firewall system.
 35. A firewall system forprocessing network content, the firewall system comprising: a networkinginterface for receiving a network connection; a networking subsystem; aproxy subsystem supporting one or more network protocols; and aconfiguration database for storing at least one firewall policy and atleast one firewall configuration scheme; wherein the networkingsubsystem re-directs the network connection to the proxy based on the atleast one firewall policy and wherein the proxy subsystem processes thenetwork content associated with the network connection based on the atleast one firewall configuration scheme.
 36. The firewall system ofclaim 35, wherein the proxy subsystem retrieves the at least onefirewall configuration scheme from the configuration database.
 37. Thefirewall system of claim 36, wherein the proxy subsystem retrieves theat least one firewall configuration scheme based on a configurationscheme identifier associated with a network session.
 38. The firewallsystem of claim 37, wherein the configuration scheme identifier isassigned to the network session by the networking subsystem.
 39. Thefirewall system of claim 35, wherein the processing of network contentby the proxy subsystem comprises applying filters to the networkcontent.
 40. The firewall system of claim 35, comprising additionalproxy subsystems, wherein multiple proxy subsystems support the one ormore network protocols.
 41. The firewall system of claim 35, whereinmultiple instances of the proxy subsystem are used for each of the oneor more network protocols
 42. The firewall system of claim 35, whereinthe proxy subsystem supports the entire communication language of theone or more network protocols.
 43. The firewall system of claim 35,wherein the proxy subsystem supports at least a part of thecommunication language of the one or more network protocols.
 44. Thefirewall system of claim 35, wherein the proxy subsystem comprises acache storing the configuration settings of the at least one firewallconfiguration scheme.
 45. The firewall system of claim 35, wherein theconfiguration database comprises an external database system.
 46. Thefirewall system of claim 35, wherein the proxy subsystem utilizes anexternal program to retrieve and apply filters to the network contentassociated with a network session.